The Free WP Mail SMTP plugin by mail250 contains a CSRF vulnerability that enables Stored XSS attacks. This affects versions up to 1.0. The vulnerability allows an attacker to trick an authenticated user into submitting a request that stores malicious script content, potentially leading to cross-site scripting. The CVSS 3.1 base score is 7.1, with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute stored malicious scripts in the context of the affected site, potentially leading to data disclosure, modification, or denial of service. The vulnerability requires user interaction but no privileges, making it a significant risk for sites using the affected plugin versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling the plugin or restricting access to trusted users only. Monitor official vendor channels for updates and apply any official fixes promptly once released.